AlmaLinux 8 : gstreamer1-plugins-bad-free (ALSA-2026:56521)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:56521 advisory. gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder CVE-2026-19387 Tenable has extracted the preceding...

CVE-2026-72304

A flaw was found in the Advanced Linux Sound Architecture ALSA System on Chip ASoC Sound Open Firmware SOF ipc4-control component of the Linux kernel. This Time-of-check to time-of-use TOCTOU vulnerability occurs in the sofipc4bytesput function, where the copy size is incorrectly derived from old...

CVE-2026-72262

A flaw was found in the Advanced Linux Sound Architecture ALSA Sound Open Firmware SOF ipc3-control component of the Linux kernel. This vulnerability, a heap overflow, occurs due to incorrect bounds checks when handling user data lengths. An unprivileged local user can exploit this to write past...

CVE-2026-56109

A flaw was found in the ALSA Advanced Linux Sound Architecture library. This double-free vulnerability, located in the parsedef function, allows a local attacker to corrupt memory by providing specially crafted ALSA configuration text. When processing nested configuration blocks, the library...

Linux Distros Unpatched Vulnerability : CVE-2026-72403

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor- specific interface without any endpoint descriptors...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102122)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102122 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out-of-bounds read in sndusbgetaudioformatuac3 In sndusbgetaudioformatuac3,...

AlmaLinux 9 : .NET 10.0 (ALSA-2026:55857)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55857 advisory. .NET: .NET Core: .NET Security Feature Bypass Vulnerability CVE-2026-62899 .NET: .NET Information Disclosure Vulnerability CVE-2026-62900 .NET: .NET Deni...

Linux Distros Unpatched Vulnerability : CVE-2026-72443

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during sndusbmidiv2create. A later setup failure can still jump to...

AlmaLinux 10 : gstreamer1-plugins-bad-free (ALSA-2026:55433)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:55433 advisory. gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder CVE-2026-19387 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-72445

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: qcom: clear opened when stream enable fails On enable, subs-opened is set before the serviceinterval is validated; an invalid interval jumps to...

Linux Distros Unpatched Vulnerability : CVE-2026-72446

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: qcom: reject stream disable with no active interface handleuaudiostreamreq resolves an interface index with infoidxfromifnum, which returns...

CVE-2026-74503

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA timer component. An unprivileged local user with access to the /dev/snd/timer and /dev/snd/seq devices can exploit a race condition where a timer instance's SNDRVTIMERIFLGDEAD flag is not properly cleared after closing...

CVE-2026-74499

A flaw was found in the kernel's Advanced Linux Sound Architecture ALSA USB audio driver. An integer overflow vulnerability in the sndusbmidiakaioutput function, when processing data from a USB device with a small bulk-OUT endpoint, can lead to an out-of-bounds write in the kernel heap. A local...

CVE-2026-74500

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture USB audio driver, specifically affecting RME Digiface devices. An unprivileged local user could exploit this vulnerability by reading the device status, which, due to an uninitialized buffer, may expose sensitive kernel...

CVE-2026-72445

A flaw was found in the Linux kernel's ALSA USB audio driver for QCOM devices. An attacker, by providing an invalid service interval during stream enablement, can cause the audio substream to become unresponsive. This can lead to a Denial of Service DoS for the affected audio device, requiring a...

kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture USB audio subsystem. An inconsistency in how USB audio playback and capture streams are handled can lead to an out-of-bounds write to a memory buffer. This can result in a system crash, causing a denial of service for a...

ALSA-2026:55433 Important: gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fixes: gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099753)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099753 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Bound MIDI endpoint descriptor scans sndusbmidigetmsinfo validates the internal...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099943)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099943 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in sndpcmdrain on linked streams sndpcmdrain uses...

ALSA-2026:55432 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: Information disclosure due to uncleared proxy authentication state CVE-2026-8927 For more details about the security...